Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."

How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day? They actually had this patched through Windows Update before Conficker became the big epidemic it did. Systems with automatic update turned off were the cause for most of the Conficker problems.

define: zero day
Pertaining to the day on which software is released; New; as yet unpatched

So it sounds like zero day means that it was present in the unpatched version?

That said, the summary says nothing about patched vs. unpatched. There would be a great outcry if a vulnerability in Linux/OSS was exploited, even though that vulnerability was already patched, and the summary failed to mention that the only reason it was exploited was because the system was NOT patched...

"In the context of security, a zero-day vulnerability is a vulnerability for which no patch exists"

References?

I bet that a exploit against a known vulnerability is not a "zero-day" attack no matter if there's still no patch.

But I wouldn't be surprised if software companies, especifically closed source software companies tried to change it to mean "no patch still delivered" of "before our monthly patch Thursday" since "zero-day attack" seems to imply the software vendor really couldn't do any better: another

That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. Yes, yes, Microsoft doesn't disclose the entire code base for their OS. The parts that were exploited (like the print spooler) are probably considered "not high enough risk" and so are disclosed to governments far and near.

In fact, the only guys playing catch-up seem to be the anti-virus writers.

So "zero-day" now means "unpatched bug", instead of the original meaning where the vulnerability was being exploited the same day it was discovered? The term "zero-day" now has no temporal meaning, then?

Actually I was responding to his specific question: "How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day?"

In response to your question, no, I don't define "zero-day" to mean "unpatched bug". I define it to mean "exploit found using unpatched bug in the wild on the day it is first reported to a security researcher (preferred), or else vendor (not ideal, as they have less incentive to disclose all important details)"

Currently, zero-day is an adjective that may be applied to any exploit (including very old exploits for which a patch has been available more than a year but never applied) including good old social engineering whenever a reporter needs to sound more authoritative or wizardy. Now we're just waiting for the -1 day exploit where due to causality violations, affected systems contact the hackers for instructions before the exploit is actually discovered.

A zero-day vulnerability is widely recognized to be a vulnerability that is found only because it's being exploited, which is how the four vulnerabilities appear to have been discovered. I suspect that the author of the article reasoned that a zero-day vulnerability remains a zero-day vulnerability even after a patch is available for it.

I don't think there's any guidelines for when, if ever, an exploit stops being called a zero-day vulnerability and becomes just a normal one.

TFS lists 5 vulnerabilities, one identified as old (MS08-067). What gives you the impression that they are calling the known exploit a zero day instead of the remaining four (previously undisclosed) that they list ? Generally when being pedantic it's best to ensure you aren't making a more obvious error.

Lots of organizations and most governments have the source to windows, its not like its this closely guarded secret. Considering Stuxnet was found infecting Iranian systems [computerworld.com] more than anything else, its probably made in the good ol' USA. This thing has NSA written all over it. Its really well-done, I guess my tax dollars are at work.

All these neat day0 exploits wasted to get into an industrial control system. The numbers of those systems are only in the thousands, they could have taken control over millions of normal Windows PCs. Who-ever designed this must have been really determined to get data out of those Siemens controllers. Wouldn't it be easier just to bribe a local operator into getting the info?

Or did they want to create their own bot-net of Scada systems? Then you can brag that you can shutdown a country at the touch of a button.

This thing is able to inject code as well. Imagine how much a company could gain if it was able to inject difficult to detect faults in its competitors products. Imagine how many armies around the world would be salivating at the opportunity to, for a few thousand dollars, basically have an opportunity to render their opponents half-billion dollar jet useless. These attacks only work, however, if you are able to fly under the radar. If the authors would have attacked normal PCs the odds of the bug being discovered and fixed would be much greater than if they only target a very small subset of Windows computers.

Depending on how the industrial control systems are use, you might be able to do a large amount of damage, and possibly kill people. Many facilities rely on industrial control systems to prevent damage to hardware (control sequencing of components, etc). Some facilities now rely on industrial controllers to provide human safety interlocks although these controllers need to be certified for life-safety applications, and I don't know if they could be vulnerable to similar attacks. Medical equipment may use si

"...noting that the worm also used signed digital certificates stolen from RealTek and JMicron..."I wonder how they obtained driver level certificates. I can imagine how, but I'd be curious to know the actual method.

I also chuckled at the fact that part of the exploit involved something that was patched a month ago. More unpatched PCs get attacked. I'm shocked. SHOCKED!